René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Security: Remaining /bin/sh -c shell-injection sites not covered by #289","articleBody":"Follow-up to #289.\n\nPR #289 fixes the `useShell=true` code path in `defaultExecutor` by routing through `shellEscapeArg`. That fix does **not** cover call sites that construct their own `/bin/sh -c` strings and pass them to the executor with `useShell=false` as `['/bin/sh', '-c', command]`. Each of these interpolates user-controlled paths into the shell string and is currently vulnerable to CWE-78.\n\n## Affected sites\n\n- `src/utils/bundle-id.ts` — `defaults read \"${appPath}/Info\" CFBundleIdentifier` and the PlistBuddy fallback\n- `src/mcp/tools/project-discovery/get_mac_bundle_id.ts` — same pattern\n- `src/mcp/tools/macos/build_macos.ts` — same pattern\n- `src/utils/macos-steps.ts` — same pattern\n\n## Regression tests already documenting these vectors\n\nThe PR carries `UNFIXED:` test cases for these sites in:\n- `src/utils/__tests__/bundle-id-injection.test.ts`\n- `src/utils/__tests__/mac-bundle-id-injection.test.ts`\n\nTheir assertions (e.g. `expect(cmdString).toContain('$(id)')`) intentionally still document the injection vectors so the audit trail remains visible. They should be flipped from `UNFIXED:` to safe assertions as each site is fixed.\n\n## Remediation options\n\nFor each site, either:\n1. Stop using `/bin/sh -c` and call `defaults` / `PlistBuddy` with an arg array directly (preferred — removes shell parsing entirely), or\n2. Apply `shellEscapeArg` (from `src/utils/command.ts`) to every interpolated value.\n\nOption (1) is a small design-shape decision per call site (whether the helper takes a path or a parsed-out arg array), which is why these were deliberately left out of the #289 rebase scope.\n\n## Why this matters\n\nAfter #289 lands, one shell-injection variant is closed and four documented variants remain live. The vulnerability is only partially mitigated until these are addressed.","author":{"url":"https://github.com/cameroncooke","@type":"Person","name":"cameroncooke"},"datePublished":"2026-04-26T21:13:32.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/367/XcodeBuildMCP/issues/367"}